Chromium-based browsers have received a fresh reminder that the internet’s finest security theater still begins with the human eyeball: two characters can make a fake domain look expensively legitimate. Not because the attackers have discovered sorcery, but because Unicode is a magnificent global writing system and also, occasionally, a phishing sommelier.

According to The Register, researchers at Have I Been Squatted found that two lookalike characters can still be abused to register domains that appear deceptively close to real websites in browsers such as Chrome and Edge. The characters are ө, used in several Cyrillic languages, and ƙ, a Latin K with hook used in languages including Hausa and Karai-karai.

🤚 The Open-Palm Homoglyph

The mechanics are familiar, which makes them more irritating. Attackers register domains that are visibly similar to trusted brands, then rely on users to see what they expect instead of what is actually there. Old-school typosquatting gave us crude gems like extra letters and suspicious misspellings. The luxury edition uses internationalized domain names, Unicode display behavior, and characters that look close enough to ASCII letters to make the browser address bar feel like an optical illusion with a compliance department.

The researchers, Ian Muscat and Leanne Briffa, said these glyphs can bypass browser safety checks and allow sites to display in Unicode as plausible lookalikes even though the underlying Punycode reveals the impostor. The Register reports that the two characters allowed researchers to register 20 lookalike domain names.

This is not a new category of threat. It is the boutique reopening of an old boutique, now with better typography and worse implications.

👐 The Two-Handed Browser Reality Check

Browser vendors have spent years trying to make internationalized domains usable without turning every address bar into a carnival mirror. That is not a trivial balance. Billions of people do not write only in ASCII, despite what certain enterprise systems from 1998 appear to believe. The web must support real languages. It must also resist criminals who look at a letterform and see a quarterly revenue opportunity.

So the browser has to decide when to show a friendly Unicode name and when to retreat into Punycode, the less glamorous encoding that begins with xn-- and looks like a barcode had a panic attack. Display too much Unicode, and phishing gets prettier. Display too much Punycode, and legitimate non-English domains are punished for the crime of not being designed around American keyboards.

This is the elegant mess security professionals keep inheriting: inclusion, usability, compatibility, and fraud all arriving at the same gala, each insisting they were invited.

🌿 The Gentle Awakening

The practical lesson is not that Unicode is bad. Unicode is excellent. Humans writing their own names, languages, and cultures on the internet is generally considered a feature by everyone except legacy billing software and the occasional procurement portal.

The lesson is that visual trust is weak trust. A padlock icon, a familiar-looking domain, and a clean login page are no longer sufficient signals. They are stage props. Attackers can rent the theater, dress the actors, and print the program. If the audience is trained only to applaud the logo, the performance will be expensive.

Organizations should treat lookalike-domain monitoring as part of brand security, not as a quaint side hobby for the paranoid intern. Security teams should watch for homoglyph registrations, train users to rely on password managers and bookmarks for sensitive services, and assume that phishing pages will continue to look less like obvious scams and more like “the official portal, but with a faint accent mark and a sinister pension plan.”

👑 The Gold-Leaf Reckoning

For defenders, this is not an apocalypse. It is another reminder that authentication cannot depend on vibes. Multi-factor authentication, passkeys, password managers, domain monitoring, email authentication, and takedown processes are the boring silverware that keep the phishing banquet from becoming a full royal dinner.

For browser makers, the challenge remains uncomfortable: protect users from deceptive Unicode without treating non-ASCII users as a suspicious class of decorative fonts. That requires careful policy, fast patching when bypasses appear, and perhaps the occasional humility that the address bar is not a truth machine. It is a small rectangle trying to summarize global language, economics, and crime. Naturally, it has developed migraines.

The attackers only need a user to see what they expect. Defenders need systems that survive what users actually do. That is the entire history of cybersecurity, embossed in gold leaf and misspelled by a domain registrar.

“The domain looked correct, which is exactly how the ambush preferred to be addressed.” — The Slap of Wisdom Phishing Aesthetics Bureau, inspecting Unicode under unfavorable lighting